CVE-2026-28519 - Vulnerability Analysis

Overview

arduino-TuyaOpen < 1.2.1 contains a heap-based buffer overflow caused by malicious DNS responses in the DnsServer component, letting attackers on the same LAN execute arbitrary code, exploit requires LAN DNS server control.

Severity & Score

Impact

Attackers controlling LAN DNS can execute arbitrary code on affected embedded devices, leading to full device compromise.

Mitigation

Update to version 1.2.1 or later.

References

• https://github.com/tuya/arduino-TuyaOpen
• https://src.tuya.com/announcement/32
• https://www.vulncheck.com/advisories/arduino-tuyaopen-dnsserver-heap-based-buffer-overflow-remote-code-execution

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner